CVE-2026-107395: 
Python vulnerability analysis and mitigation

CVE-2026-107395 is a missing authorization vulnerability in Indico, an open-source event management system developed by CERN, affecting all versions prior to 3.3.13. The flaw resides in the legacy session export API, which fails to enforce access controls on restricted sessions within accessible events. It was originally published by the maintainer on August 25, 2026, and registered in the NVD on October 8, 2026. The vulnerability carries a CVSS v3.1 base score of 4.3 (Medium) (GitHub Advisory, Indico Security Advisory).

The root cause is classified as CWE-862 (Missing Authorization): the _build_sessions_api_data method in indico/modules/events/api.py iterated over all sessions associated with an event without checking whether the requesting user had access to each individual session. The fix, introduced in commit 524e8e9, adds a session_.can_access(self.user) check that skips sessions the user is not authorized to view. An authenticated attacker with access to the parent event can craft a request to the legacy session export API endpoint to enumerate restricted session metadata — no elevated privileges beyond basic authentication are required (Indico Commit, GitHub Advisory).

Successful exploitation allows any authenticated user with access to an event to retrieve metadata — including title, description, and convener names — of restricted sessions within that event that they are not authorized to view. The impact is limited to confidentiality of session metadata; there is no integrity or availability impact, and no pathway to code execution or lateral movement is introduced by this vulnerability alone. The exposure is scoped to the affected Indico instance and does not affect the broader host system (GitHub Advisory, Indico Security Advisory).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time (Feedly). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.235%, placing it in the 13th percentile for exploitation likelihood within 30 days (GitHub Advisory). Exploitation requires a valid authenticated session, which limits the attacker pool to registered users of the affected Indico instance.

1. Authenticate: Log in to an Indico instance running a version prior to 3.3.13 with any valid user account that has access to at least one event.
2. Identify target event: Browse or enumerate accessible events on the platform to find one that contains restricted sessions (sessions with access controls more restrictive than the parent event).
3. Query the legacy session export API: Send an authenticated HTTP GET request to the legacy session export API endpoint for the target event (e.g., /export/event/<event_id>/session.json or equivalent legacy API path).
4. Retrieve restricted session metadata: Parse the API response, which — due to the missing access check — will include metadata (title, description, conveners) for all sessions in the event, including those the user is not authorized to access (Indico Commit, GitHub Advisory).

• Network: Repeated or automated HTTP GET requests to the Indico legacy session export API endpoint (e.g., paths matching /export/event/*/session.*) from a single authenticated user account, particularly for events the user does not manage.
• Logs: Web server or application access logs showing high-frequency requests to session export API endpoints across multiple event IDs from the same user or IP address in a short time window.
• Application Logs: Indico application logs recording API access to session export endpoints for events where the requesting user has no session-level permissions.

The primary remediation is to upgrade Indico to version 3.3.13 or later, which includes the fix for this vulnerability (Indico Release). As a temporary workaround prior to patching, administrators can restrict access to the parent event itself, which prevents unauthorized users from reaching the vulnerable API endpoint (GitHub Advisory). For questions or assistance, the Indico team can be contacted at indico-team@cern.ch.

The vulnerability was reported by security researcher arpitjain099 and disclosed responsibly through GitHub's security advisory process by Indico maintainer ThiefMaster (Indico Security Advisory). No significant broader media coverage or notable community commentary beyond the standard advisory channels has been observed for this moderate-severity issue.